Menu

Social Engineering

Pretexting and Blagging

Pretexting and blagging are social engineering techniques that rely on a believable reason rather than a technical flaw. The attacker does not break into a system; they give you a reason to hand information over.

Pretexting

Pretexting is an attack where the attacker invents a believable situation that gives a reason for asking for information. They might pretend to be a technician, a competition organiser or a new member of staff. For example, a message claims to be from the organisers of a coding competition your class has entered. Your entry, it says, has a file error and will be wiped unless you send your school username and password so it can be resubmitted before the deadline. The invented problem is the pretext. It makes the request sound urgent and normal, so you may reply before checking who is really behind the message.

Blagging

Blagging is a confidence trick in which the attacker gains your trust and then persuades you to reveal information. The trust can be built in minutes or over several conversations. For example, someone joins your online game lobby, plays a few friendly rounds, then asks for your login so they can finish a tough co-op level for you while you are offline. The friendly history makes the request feel like a favour between teammates. Blagging works because you are more likely to help someone you believe you know and like.

Comparing the two

PretextingBlagging
What the attacker buildsA believable situation or roleYour trust and friendship
When the request comesStraight away, inside the storyAfter trust has been gained
Why you complyThe reason fits and feels urgentYou feel you know the person
ExampleFake competition organiser resubmitting your entryFriendly teammate asking a favour

Both tricks work because the request arrives with a reason attached. In pretexting the reason is a made-up situation; in blagging it is a relationship the attacker has built. An attacker can use both together: invent a role, then spend time being friendly before making the request.

Practise this